Seguridad de WordPress hoy: plugins, WordPress y PHP

Últimas vulnerabilidades críticas y altas

Actualiza o sustituye primero estos plugins. Pide a tu agente que revise los tuyos con wp_security.

HIGHGiveWPAuthenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter · up to 4.19.1 · fixed in 4.19.1.14 Nov

HIGHLiteSpeed CacheUnauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST Caching · up to 7.9.1 · fixed in 7.9.24 Nov

HIGHMotorsAuthenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter · up to 1.4.128 · fixed in 1.4.1294 Nov

HIGHSAML SP Single Sign OnAllocation of Resources Without Limits or Throttling · up to 6.1.04 Nov

HIGHDoofinder for WooCommerceInsertion of Sensitive Information into Externally-Accessible File or Directory · up to 2.17.24 Nov

HIGHWCFM MarketplaceMissing Authorization · up to 3.8.24 Nov

HIGHStape Conversion TrackingServer-Side Request Forgery · before 2.3.114 Nov

HIGHNoptinCross-site Scripting · up to 4.4.24 Nov

HIGHWP Customer AreaCross-site Scripting · up to 8.4.14 Nov

HIGHWP Booking SystemCross-site Scripting · up to 2.1.0.64 Nov

¿Tu sitio está afectado?Pega esto a tu agente. Lee tus versiones con WP-CLI y revisa cada plugin y tema en una sola llamada.

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Qué hacer ahora

2 NovSeguridad

HTTP2Shell: critical Brotli flaw reachable through WordPress

Ask the host whether the Brotli decoder serving the site is patched for CVE-2026-111497 and the services were restarted after the update (on a VPS, update the system packages, then restart). Blocking unauthenticated XML-RPC pingbacks removes only the route shown in the public exploit and may break integrations; the xmlrpc_enabled filter and the Settings > Discussion option do not block them. Fuente

29 OctSeguridad

Core Security Initiative: security releases now come often

Keep automatic minor (security) updates on, and expect more security releases: apply each one quickly rather than batching updates. Fuente

28 OctSeguridad

WordPress 7.1.4 security release

Update to WordPress 7.1.4 now; fixes are being backported to older branches down to 4.7. Fuente

21 OctPHP

Critical PHP security release

Update PHP on every server now and move sites off PHP 8.1 or older (check Tools → Site Health → Info → Server). Fuente

16 OctMCP

MCP Adapter 0.7.1 and 0.6.2 security fixes

Update to MCP Adapter 0.7.1 (or 0.6.2 for Composer users on 0.6.x) and stop matching on ability_not_public_mcp. Fuente

6 OctSeguridad

WordPress 7.1.3 security and maintenance release

Update to WordPress 7.1.3 or later (7.1.4 is current). Fuente

Revisa tus plugins y temas

Dale a tu agente los plugins y temas de tu sitio. Para cada uno recibe la última versión, si vas atrasado y qué vigilar.

Formulo2.1 → 2.3Actualizar

Pebble Forms1.1Al día

Formwise3.8Sin probar con WordPress 7.1

Lo que tu agente recibe de wp_security

Lista los plugins de mi sitio con sus versiones y luego revísalos con Today WP.

¿Algún plugin de mi sitio está desactualizado o sin probar con el WordPress actual?

La seguridad de WordPress, hoy.